Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 07:19

General

  • Target

    0194672de875d36b6d9f8bc56823a0163623f0335b94d0c4b0813f0d69fd7305.exe

  • Size

    5.7MB

  • MD5

    569b6ba8be8e12e4e5f76b729704fbf3

  • SHA1

    06bd76ec19c7721d815ac0e56009f67cabf0080d

  • SHA256

    0194672de875d36b6d9f8bc56823a0163623f0335b94d0c4b0813f0d69fd7305

  • SHA512

    dfa251687d19b02faadb634516927376cf17f9c79c23c6933d29085e69e6be2d3988a912d50d132d3a0449759b807de0c389a029dc26b8bfd013eda27235b174

  • SSDEEP

    49152:7KPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPn:7sKUgTH2M2m9UMpu1QfLczqssnKSk

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\0194672de875d36b6d9f8bc56823a0163623f0335b94d0c4b0813f0d69fd7305.exe
        "C:\Users\Admin\AppData\Local\Temp\0194672de875d36b6d9f8bc56823a0163623f0335b94d0c4b0813f0d69fd7305.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2228
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:1716
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1D12.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            PID:2136
            • C:\Users\Admin\AppData\Local\Temp\0194672de875d36b6d9f8bc56823a0163623f0335b94d0c4b0813f0d69fd7305.exe
              "C:\Users\Admin\AppData\Local\Temp\0194672de875d36b6d9f8bc56823a0163623f0335b94d0c4b0813f0d69fd7305.exe"
              4⤵
              • Executes dropped EXE
              PID:2860
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1660
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1664
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2720
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2940
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2628

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            258KB

            MD5

            3048e9960b26e794efcfd7c8dc837662

            SHA1

            258fa57ecf54672ab08e11114ad150ac14b1df68

            SHA256

            94c6fea3fa36d73ee929a20d4c0f650a5df5e1cf3dafb150382225e72aaf349f

            SHA512

            edc0b09e1163bf01bb59a4b09a69d82fd515410ffa4a192b05491f84eff0c9fa92dc19a548fefc995ec5170f12d6768195c438ad59961b312aab4b2c5cd8a95a

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            478KB

            MD5

            e3ed025983edd3f0811b528d691f5aad

            SHA1

            d4dba9af05f4499e9b7b9152b4b79fdc392fea0e

            SHA256

            baabdc56c507e1820de6caf9cfd27eb3298c955fe5725460cfb9b2e833546005

            SHA512

            f0c40858619b35c307a55ecb3647645717a05fc229dcf3af6562720305a38b4ed2e7f4000a50ba44d2644173a1c99c8781859236f497c4d79437d19043914567

          • C:\Users\Admin\AppData\Local\Temp\$$a1D12.bat

            Filesize

            722B

            MD5

            49085f43fdbfbd8ee33f8807d68d5425

            SHA1

            930e11a35bea2ad71814c98b13a1957a35a165a3

            SHA256

            60875cdbd64f3c9b02af2718f96eae7a52a28dfdee85b33f093fd83e508f8ec0

            SHA512

            7c0336ef0d9a5547abcfd31ca872f6ef4f6eaf49cb5521385b77a11266ab7982356fd6cd1f3003a77d286684f22c57d1e19349913f82238b9465f59feccd22f3

          • C:\Users\Admin\AppData\Local\Temp\0194672de875d36b6d9f8bc56823a0163623f0335b94d0c4b0813f0d69fd7305.exe.exe

            Filesize

            5.7MB

            MD5

            ba18e99b3e17adb5b029eaebc457dd89

            SHA1

            ec0458f3c00d35b323f08d4e1cc2e72899429c38

            SHA256

            f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628

            SHA512

            1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c

          • C:\Windows\Logo1_.exe

            Filesize

            33KB

            MD5

            2a9224a2c7ff6663b5816467b80de064

            SHA1

            b39f76a521d3b30052ea3533b2b27b61dfbe03d1

            SHA256

            98f83bf4cbd3fca43aa6128dc963be1b76c6224f971eacee1ba9af2d547f70e7

            SHA512

            dee725ddfdcc0ce80c55ca1dc839ef71d98faa73fab3a5f45063fa328eb558724983cab281f0f3e6e1bdd640d957e8d69a6c5ffec7c8c6f16dd695bcd90ac3ba

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            832B

            MD5

            7e3a0edd0c6cd8316f4b6c159d5167a1

            SHA1

            753428b4736ffb2c9e3eb50f89255b212768c55a

            SHA256

            1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

            SHA512

            9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

          • F:\$RECYCLE.BIN\S-1-5-21-3691908287-3775019229-3534252667-1000\_desktop.ini

            Filesize

            9B

            MD5

            db64fea40b8b0f0d620ef2ecc6eadbca

            SHA1

            51736590bfbfbac961899ddcc9be998bfeabd3d5

            SHA256

            946d3f6b9ecc2fa53895526caf79e41850ad594f22a240d93f8bb7eb286d70f8

            SHA512

            b70e24f5930090ac0c9a584f3810d41af8de5562c6b78f6979ea97c929edc18d57bedb9af335d19307aa0db00004aa5a4e553f24ac884365d8bd899d6f3258c0

          • memory/1204-29-0x00000000024F0000-0x00000000024F1000-memory.dmp

            Filesize

            4KB

          • memory/1660-33-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1660-19-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1660-3304-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/1660-4135-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2040-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2040-18-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB